[Samsung Infuse 4G] nblender:
(registered just to post this. I'm posting because all the googling I did wasn't overly enlightening though did give me a bunch of clues. This is all stuff I discovered while trying to unlock my phone and is stuff I hadn't seen documented anywhere so hopefully it will be useful to some future googler. ).

I was trying to unlock an Infuse I997 running cyanogenmod/ICS. Using 'adb shell', I was able to find the nv_data.bin; two of them actually. One in /efs/nv_data.bin that appeared to be a backup and another in /efs/root/afs/settings/nv_data.bin which appeared to be the active one...

The difference between the active one and the inactive one were these lines:

00001500 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 05 00 |................|

vs:

00001500 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 04 00 |................|

I suspected, correctly, that whenever you enter an invalid network unlock code, it decrements a counter at 0x150e.

The unlock code block seems to be at 0x1460 thereabouts:

00001460 ff ff ff ff ff ff ff ff ff 01 00 00 00 00 32 38 |..............28|

00001470 36 38 34 39 32 37 ff ff ff ff ff ff ff ff ff ff |684927..........|

00001480 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 30 |..............00|

00001490 30 30 30 30 30 30 ff ff ff ff ff ff ff ff ff ff |000000..........|

000014a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 30 |..............00|

000014b0 30 30 30 30 30 30 ff ff ff ff ff ff ff ff ff ff |000000..........|

000014c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 30 |..............00|

000014d0 30 30 30 30 30 30 ff ff ff ff ff ff ff ff ff ff |000000..........|

000014e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 30 |..............00|

000014f0 30 30 30 30 30 30 ff ff ff ff ff ff ff ff ff ff |000000..........|

00001500 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 04 00 |................|

00001510 00 00 00 03 05 05 05 05 00 ff ff ff ff ff ff ff |................|

00001520 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|

Unfortunately, the unlock code 28684927 did not actually work. I tried a bunch of stuff, always keeping nv_data.bin from counting down to 0...

Other discoveries that I made were that if you generated the wrong nv_data.bin.md5, then it restored a 'default nv_data.bin' file which in my case was all 0x00's... This results in an IMEI that is garbage characters which I assumed would cause some flags at the provider...

So it's important to ensure that when you replace /efs/root/afs/settings/nv_data.bin, that you also generate a valid /efs/root/afs/settings/nv_data.bin.md5. I tried the busybox md5sum command and it always generated an incorrect md5 which always resulted in nv_data.bin being overwritten.

Fortunately, there is a /efs/nv.log which is the output of whatever command checks/verifies nv_data.bin:

Wed Feb 20 18:12:48 2013: MD5 fail. orignal md5 '43b755476a91bf8068489cfdcc399b3d' computed md5 '394ae4ad7aedea383e416206bbb49504' (rild)

Wed Feb 20 18:12:48 2013: default NV restored.

Thu Feb 21 06:21:54 2013: MD5 fail. orignal md5 'fa919ba01bfb172f6fac4fd450c58eb3' computed md5 'bf3dab9dee47237d14ae6abee029d05a' (rild)

Thu Feb 21 06:21:54 2013: default NV restored.

So I would copy a different nv_data.bin in place, reboot, then check the log and see what the computed md5 was, and re-copy nv_data.bin with a correct nv_data.bin.md5.. This seemed to work correctly.

It's important to do this whenever you copy or create an nv_data.bin{.md5} file:

chown radio:radio nv_data*

chmod 700 nv_data*

because permissions/ownership is another possible fail for whatever tool does the checking.

Ultimately, I wasn't sure how to unlock the phone because the code didn't work and there were no other codes in the file... So on a lark, I installed a hex editor on my Mac, did an "adb pull" of nv_data.bin, changed 0x01 at 0x1469 to 0x00, "adb push" it back into a temporary location, then "adb shell", "su", and "cp /sdcard/tmp/nv_data.bin.hack /efs/root/afs/settings/nv_data.bin", then reboot, check nv.log to find the computed checksum, re-copied nv_data.bin and generated a /efs/root/afs/settings/nv_data.bin.md5 from the computed checksum and rebooted again. Voila, the phone was unlocked and functional.

So here's the step by step:

get a USB cable, install the android sdk.

run sdk/platform-tools/adb shell

su

cp /efs/root/afs/settings/nv_data.bin /sdcard/nv_data.bin.bak

exit

sdk/platform-tools/adb pull /sdcard/nv_data.bin.bak .

hexedit nv_data.bin.bak

Set 0x1469 to 0x00

save, exit

sdk/platform-tools/adb push ./nv_data.bin.bak /sdcard/nv_data.bin.hacked

sdk/platform-tools/adb shell

su

cp /sdcard/nv_data.bin.hacked /efs/root/afs/settings/nv_data.bin

reboot

sdk/platform-tools/adb shell

su

tail /efs/nv.log

-- find computed md5 (lets say it is: "bf3dab9dee47237d14ae6abee029d05a")

echo -n "bf3dab9dee47237d14ae6abee029d05a" > /efs/root/afs/settings/nv_data.bin.md5

cp /sdcard/nv_data.bin.hacked /efs/root/afs/settings/nv_data.bin

reboot

that's it... Obviously, no warranty is expressed or implied, blah blah blah ...